p PatchFirst

CVE-2019-1010266

CVE-2019-1010266

This page contains facts from public vulnerability sources. Check the original advisory before updating.

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

CVSS 6.5 · Medium · EPSS 3.0% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • lodash

    Versions
    • <4.17.11 [fixed: 4.7.11]: Affected

    No fix published

  • node-lodash Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.17.11+dfsg-1

    Update to 4.17.11+dfsg-1

  • node-lodash Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.17.11+dfsg-1

    Update to 4.17.11+dfsg-1

  • node-lodash Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.17.11+dfsg-1

    Update to 4.17.11+dfsg-1

  • lodash npm

    Affected ranges
    • SEMVER: ≥ 4.7.0, < 4.17.11

    Update to 4.17.11

  • lodash-es npm

    Affected ranges
    • SEMVER: ≥ 4.7.0, < 4.17.11

    Update to 4.17.11

  • lodash-amd npm

    Affected ranges
    • SEMVER: ≥ 4.7.0, < 4.17.11

    Update to 4.17.11

  • lodash-rails RubyGems

    Versions
    • 4.11.2
    • 4.12.0
    • 4.13.1
    • 4.14.1
    • 4.15.0
    • 4.16.1
    • 4.16.3
    • 4.16.4
    • 4.16.6
    • 4.17.10
    • 4.17.2
    • 4.17.4
    • 4.17.5
    Affected ranges
    • ECOSYSTEM: ≥ 4.7.0, < 4.17.11

    Update to 4.17.11

  • node-lodash Ubuntu:Pro:18.04:LTS

    Versions
    • 4.17.4+dfsg-1
    • 4.17.4+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →